SECURITY IN INFORMAL, MULTI-USER SETTINGS

Abstract

Users commonly behave in ways that go against security experts' and developers' expectations and desires, whether it be ignoring security best practices or otherwise taking shortcuts. Many of these expectations and systems are often designed and its users understood in the single-user context. However, users do not exist in isolation; they often share devices and digital resources with one another. Security and privacy goals are further complicated when multiple stakeholders are involved, and traditional security frameworks and expectations often do not map cleanly to how users actually interact with one another.

In my thesis, I build off of single-user studies and frameworks by exploring generally-cooperative interpersonal relationships and their impacts on user behavior and perceptions on security and privacy. In doing so, I suggest improvements to design decisions and considerations that take users' everyday lived experiences and needs into account. I examine these multi-user interactions through two contexts: smart home devices and passwords.

I first focus on smart home devices, a space where incidental users, who are often not explicitly given access to devices but are nonetheless able to interact with them, become stakeholders by virtue of being in the same physical space. To better understand the day-to-day security and privacy violations smart home owners face from incidental users, in contrast to rare but technically-advanced remote attacks that tend to dominate smart home discussion, I conducted two surveys with representative samples in the U.S.; one to characterize the types of interpersonal device misuse owners experience and one to estimate the prevalence of these incidents. I find that device owners commonly reported device usage that security experts may traditionally consider to be privacy and security violations, such as unauthorized device use or changes to device settings, from others in their social circle, such as family members. However, despite the potential severity of some of these incidents, many of these device owners viewed these incidents as benign or even expected.

Next, I build on this work by further investigating the complex social factors and norms smart home device owners use to evaluate the appropriateness of unauthorized use of their devices. I conducted a vignette study examining the relative importance of different factors, including permission, relationship, device, and consequences, in smart home device owners' perceptions of device usage by incidental users. I find that while permission has the greatest impact on these perceptions, it is not always clear-cut; certain relationship contexts confer permission even if not explicitly granted. In addition, users tend to rely on social responses, such as conversations, when they perceive that their devices have been misused over technical solutions, such as strict access control measures.

My next area of study focuses on passwords and sharing of accounts. In contrast to smart home devices, these shared accounts are primarily digital and often involve purposeful, controlled access. In addition, such sharing requires users to work around these accounts' single-user design and go against security advice to accomplish goals important to them. I examined the ways users create passwords for these shared accounts through a survey study. Despite multiple users and their capabilities being a consideration, many of these passwords are created individually, rather than collaboratively. Overall, these users tend to use similar strategies to create shared passwords as they do for non-shared passwords, though they make additional security concessions for other users' usability and sometimes reuse passwords across shared and non-shared contexts.

Finally, I investigate why password managers, a technical solution that could theoretically address concerns around reuse, password memorability, and password transmission in the shared context, has failed to find popular adoption among users sharing accounts. I built a taxonomy on current implementations of password-sharing features in popular password managers, finding that they are diverse and opaque. I then conducted a survey with users of password managers to better understand obstacles to adoption of password managers for sharing. My work reveals that users of password managers are often unaware of these sharing features despite their utility. More broadly and pressing, however, is that the ways these features are implemented and presented are mismatched with the everyday sharing-with-trusted-recipients scenarios users engage in. This mismatch perhaps contributes users tend to preferring less-secure but more-usable means, such as verbal transmission, for sharing and managing these passwords.

My thesis demonstrates the need for security and privacy design to account for users' lived experiences, and the need to examine users not as isolated beings, but as part of a social network that impacts how they view and prioritize their own security. By understanding this, we can design systems that work with, rather than in opposition to, users' lived experiences.